Summary

Adds focused regression coverage for residual high-risk seams on main that are still untested and not claimed by open coverage PRs #298–#306 (main tip still at fa5c0f68). Also refreshes canary mobile lockfile + research-readiness desktop bridge stabilizers, and unflakes the calendar-aged composer draft prune assertion.

Risky behavior now covered

• Managed runtime archive install fail-closed — invalid expected SHA-256, checksum mismatch (no install), and already-installed overwrite without force.
• HTTP JSON-RPC response timeout — unanswered /rpc requests return 503 with Timed out waiting for JSON-RPC response. and clear pending waiters (tiny injectable responseTimeoutMs test seam).
• Session backup containment — create refuses backups whose directory would sit inside the working directory; restore refuses poisoned metadata that places the backup under WD; create refuses mismatched session-id reuse.
• MCP invalid client / tool schemas — optional servers collect invalid runtime shape / invalid tool definitions; required invalid shape tears down peer clients and throws.
• Provider API-key connect exception — unexpected connect throws emit provider_error (Setting provider API key failed: …) and always clear connecting.

Test files added/updated

• test/coworkRuntime.installArchive.test.ts (added)
• test/h3.http-jsonrpc-timeout.test.ts (added)
• test/session-backup.containment.test.ts (added)
• test/mcp.invalid-client.test.ts (added)
• test/session/agentSession.provider-api-key-exception.test.ts (added)
• src/server/transport/httpJsonRpcConnection.ts / src/server/transport/h3/server.ts (responseTimeoutMs option only)
• apps/desktop/test/research-readiness.test.tsx + apps/mobile/bun.lock (CI stabilizers)
• apps/desktop/test/composer-draft-thread-switch.test.ts (Date.now()-relative prune fixtures)

Why these tests materially reduce regression risk

These paths are trust boundaries and stuck-state hazards: corrupt runtime install, hung mobile HTTP RPC waiters, restore/overwrite of the wrong workspace tree, hostile MCP client shapes crashing mid-turn, and auth left stuck in connecting. None duplicate open #298–#306 claims.

Validation

• Targeted new suites green
• Touched files Biome-clean
• bun run lint / bun run typecheck / bun run docs:check clean
• Full bun run test: all 677 files passed (Bun 1.4.0-canary)